Explainable Graph Neural Networks for Network Intrusion Detection SystemsWilson, Cayden Machine LearningGraph Neural NetworkCybersecurityNetworkingData ScienceData SciencesB SThe arrival of the Internet of Things has drastically increased the scale and complexity of our networks. Traditional network intrusion detection systems (NIDS) can detect malicious traffic patterns and statistical anomalies, but there is limited capability in detecting novel attack patterns. Machine learning architectures prove to be useful for NIDS, and graph neural network (GNN) models are an appealing choice for ML-based network intrusion detection systems. These architectures use a message passing mechanism to extract relational information about the flow of network data between devices. While highly accurate in binary detection scenarios, many ML-based algorithms may fail to detect attack types accurately in multiclass classification scenarios. Understanding the outputs of NIDS models is crucial, and GNN explainer methodologies can reveal which subgraphs and features were most influential in GNN model outputs. A GNN model is implemented and evaluated with a graph explainer methodology to examine the output’s relevance to a particular class of cyber-attack. This process can help system administrators to build confidence in AI-driven network monitoring tools while also allowing for understanding where the model deviates from our expectations. Suhang Wang, Thesis SupervisorJohn Yen, Thesis Honors Advisoropen_access2025-04-29T22:57:12Zhttps://honors.libraries.psu.edu/catalog/9774cpw5598